Merge pull request #1865 from rocket-admin/backend_agent_table_public_permissions

Backend agent table public permissions

Author: Artuomka

backend/src/common/data-injection.tokens.ts

@@ -183,6 +183,7 @@ export enum UseCaseType {
 	AGENTS_VALIDATE_TABLE_AI_REQUEST = 'AGENTS_VALIDATE_TABLE_AI_REQUEST',
 	AGENTS_VALIDATE_CONNECTION_EDIT = 'AGENTS_VALIDATE_CONNECTION_EDIT',
 	AGENTS_SET_PUBLIC_PERMISSIONS = 'AGENTS_SET_PUBLIC_PERMISSIONS',
+	AGENTS_SET_SITE_RUNTIME_POLICY = 'AGENTS_SET_SITE_RUNTIME_POLICY',
 	AGENTS_GET_AI_CONNECTION_CONTEXT = 'AGENTS_GET_AI_CONNECTION_CONTEXT',
 	AGENTS_GET_AI_CONNECTION_TABLES = 'AGENTS_GET_AI_CONNECTION_TABLES',
 	AGENTS_GET_AI_TABLE_STRUCTURE = 'AGENTS_GET_AI_TABLE_STRUCTURE',

backend/src/entities/connection/connection.entity.ts

@@ -120,6 +120,16 @@ export class ConnectionEntity {
 	@Column({ type: 'text', nullable: true, default: null })
 	public_cedar_policy?: string | null;
 
+	// Server-side site data contract for the SiteNova generated-site runtime API (plan 13 §4),
+	// served to universal-backend inside the internal credentials response. Presence marks the
+	// connection as backing a real generated site (Step 2a allow-list); its shape (auth/write/
+	// owned-read rules) is consumed by universal-backend's SiteContractService in Step 2b. NULL for
+	// every ordinary admin-panel connection.
+	// jsonb value typed `Record<string, any>` to match the existing jsonb columns
+	// (e.g. TableFiltersEntity.filters) and keep TypeORM's update() deep-partial typings happy.
+	@Column({ type: 'jsonb', nullable: true, default: null })
+	site_runtime_policy?: Record<string, any> | null;
+
 	/**
 	 * Non-persisted flag indicating whether credentials are currently in decrypted state.
 	 * Used by @BeforeUpdate to decide whether encryption is needed.

backend/src/entities/connection/repository/connection.repository.interface.ts

@@ -32,6 +32,13 @@ export interface IConnectionRepository {
 
 	updateConnectionPublicCedarPolicy(connectionId: string, publicCedarPolicy: string | null): Promise<void>;
 
+	getConnectionSiteRuntimePolicy(connectionId: string): Promise<Record<string, unknown> | null>;
+
+	updateConnectionSiteRuntimePolicy(
+		connectionId: string,
+		siteRuntimePolicy: Record<string, unknown> | null,
+	): Promise<void>;
+
 	findOneAgentConnectionByToken(connectionToken: string): Promise<ConnectionEntity | null>;
 
 	decryptConnectionField(field: string): string;

backend/src/entities/connection/repository/custom-connection-repository-extension.ts

@@ -216,6 +216,25 @@ export const customConnectionRepositoryExtension: IConnectionRepository &
 			.execute();
 	},
 
+	async getConnectionSiteRuntimePolicy(connectionId: string): Promise<Record<string, unknown> | null> {
+		const connection = await this.createQueryBuilder('connection')
+			.select(['connection.id', 'connection.site_runtime_policy'])
+			.where('connection.id = :connectionId', { connectionId })
+			.getOne();
+		return connection?.site_runtime_policy ?? null;
+	},
+
+	async updateConnectionSiteRuntimePolicy(
+		connectionId: string,
+		siteRuntimePolicy: Record<string, unknown> | null,
+	): Promise<void> {
+		await this.createQueryBuilder()
+			.update(ConnectionEntity)
+			.set({ site_runtime_policy: siteRuntimePolicy })
+			.where('id = :connectionId', { connectionId })
+			.execute();
+	},
+
 	async isUserFromConnection(userId: string, connectionId: string): Promise<boolean> {
 		const qb = this.createQueryBuilder('connection')
 			.leftJoin('connection.groups', 'group')

backend/src/exceptions/text/messages.ts

@@ -105,6 +105,9 @@ export const Messages = {
 	PUBLIC_POLICY_ACTION_NOT_ALLOWED:
 		'Public permissions may only grant QueryTable (table:query) and ColumnRead (column:read)',
 	PUBLIC_ACCESS_NOT_CONFIGURED: 'Public access is not configured for this connection',
+	PUBLIC_GRANT_ON_AUTH_TABLE_NOT_ALLOWED:
+		"Public read cannot be granted on the site's visitor accounts table or its credential column",
+	SITE_RUNTIME_POLICY_INVALID: 'Site runtime policy must be a JSON object',
 	CSV_EXPORT_FAILED: 'CSV export failed',
 	CSV_EXPORT_DISABLED: 'CSV export is disabled',
 	CSV_IMPORT_FAILED: 'CSV import failed',

backend/src/microservices/agents-microservice/agents.controller.ts

@@ -16,6 +16,7 @@ import {
 	CompanySubscriptionInfoRO,
 	PermissionAllowedRO,
 	PublicPermissionsRO,
+	SiteRuntimePolicyRO,
 	ValidatedUserTokenRO,
 } from './data-structures/agents-responses.ds.js';
 import {
@@ -28,6 +29,7 @@ import {
 import { ValidateConnectionEditDto, ValidateTableAiRequestDto, ValidateUserTokenDto } from './dto/agents-auth.dtos.js';
 import { GetCompanySubscriptionInfoDto } from './dto/agents-company.dtos.js';
 import { SetAgentsPublicPermissionsDto } from './dto/agents-public-permissions.dtos.js';
+import { SetSiteRuntimePolicyDto } from './dto/agents-site-runtime-policy.dtos.js';
 import {
 	IExecuteAiAggregationPipeline,
 	IExecuteAiRawQuery,
@@ -38,6 +40,7 @@ import {
 	IGetCompanySubscriptionInfo,
 	IScanAndCreateSettings,
 	ISetPublicPermissions,
+	ISetSiteRuntimePolicy,
 	IValidateConnectionEdit,
 	IValidateTableAiRequest,
 	IValidateUserToken,
@@ -59,6 +62,8 @@ export class AgentsController {
 		private readonly validateConnectionEditUseCase: IValidateConnectionEdit,
 		@Inject(UseCaseType.AGENTS_SET_PUBLIC_PERMISSIONS)
 		private readonly setPublicPermissionsUseCase: ISetPublicPermissions,
+		@Inject(UseCaseType.AGENTS_SET_SITE_RUNTIME_POLICY)
+		private readonly setSiteRuntimePolicyUseCase: ISetSiteRuntimePolicy,
 		@Inject(UseCaseType.AGENTS_GET_AI_CONNECTION_CONTEXT)
 		private readonly getAiConnectionContextUseCase: IGetAiConnectionContext,
 		@Inject(UseCaseType.AGENTS_GET_AI_CONNECTION_TABLES)
@@ -127,6 +132,26 @@ export class AgentsController {
 		);
 	}
 
+	@ApiOperation({
+		summary: 'Write the site data contract (runtime manifest) for a generated site — agent finalize flow',
+		description:
+			'Re-checks Cedar connection:edit for the given user, then stores the manifest on the connection ' +
+			'(site_runtime_policy, replacing any previous one). universal-backend enforces it at the generated-site ' +
+			'runtime: auth-table pinning, write allow-lists with ownership, owner-scoped reads (plan 13 Step 2b).',
+	})
+	@ApiResponse({ status: 201, type: SiteRuntimePolicyRO })
+	@ApiBody({ type: SetSiteRuntimePolicyDto })
+	@Post('/connection/site-runtime-policy/:connectionId')
+	public async setSiteRuntimePolicy(
+		@SlugUuid('connectionId') connectionId: string,
+		@Body() body: SetSiteRuntimePolicyDto,
+	): Promise<SiteRuntimePolicyRO> {
+		return await this.setSiteRuntimePolicyUseCase.execute(
+			{ connectionId, userId: body.userId, policy: body.policy },
+			InTransactionEnum.OFF,
+		);
+	}
+
 	@ApiOperation({ summary: 'Get AI-relevant connection context (type, schema, MongoDB flag)' })
 	@ApiResponse({ status: 201, type: AiConnectionContextRO })
 	@ApiBody({ type: AiDataRequestBaseDto })

backend/src/microservices/agents-microservice/agents.module.ts

@@ -13,6 +13,7 @@ import { GetAiTableStructureUseCase } from './use-cases/get-ai-table-structure.u
 import { GetCompanySubscriptionInfoUseCase } from './use-cases/get-company-subscription-info.use.case.js';
 import { ScanAndCreateSettingsUseCase } from './use-cases/scan-and-create-settings.use.case.js';
 import { SetPublicPermissionsUseCase } from './use-cases/set-public-permissions.use.case.js';
+import { SetSiteRuntimePolicyUseCase } from './use-cases/set-site-runtime-policy.use.case.js';
 import { ValidateConnectionEditUseCase } from './use-cases/validate-connection-edit.use.case.js';
 import { ValidateTableAiRequestUseCase } from './use-cases/validate-table-ai-request.use.case.js';
 import { ValidateUserTokenUseCase } from './use-cases/validate-user-token.use.case.js';
@@ -40,6 +41,10 @@ import { ValidateUserTokenUseCase } from './use-cases/validate-user-token.use.ca
 			provide: UseCaseType.AGENTS_SET_PUBLIC_PERMISSIONS,
 			useClass: SetPublicPermissionsUseCase,
 		},
+		{
+			provide: UseCaseType.AGENTS_SET_SITE_RUNTIME_POLICY,
+			useClass: SetSiteRuntimePolicyUseCase,
+		},
 		{
 			provide: UseCaseType.AGENTS_GET_AI_CONNECTION_CONTEXT,
 			useClass: GetAiConnectionContextUseCase,

backend/src/microservices/agents-microservice/data-structures/agents-responses.ds.ts

@@ -34,6 +34,15 @@ export class PublicPermissionsRO {
 	tables: Array<{ tableName: string; readableColumns?: Array<string> }>;
 }
 
+export class SiteRuntimePolicyRO {
+	@ApiProperty({
+		type: 'object',
+		additionalProperties: true,
+		description: 'The site runtime policy (data contract) now stored on the connection.',
+	})
+	policy: Record<string, unknown>;
+}
+
 export class AiConnectionContextRO {
 	@ApiProperty()
 	connectionId: string;

backend/src/microservices/agents-microservice/data-structures/agents.ds.ts

@@ -18,6 +18,12 @@ export class SetPublicPermissionsDs {
 	mode: 'merge' | 'replace';
 }
 
+export class SetSiteRuntimePolicyDs {
+	userId: string;
+	connectionId: string;
+	policy: Record<string, unknown>;
+}
+
 export class AiDataRequestDs {
 	connectionId: string;
 	userId: string;

backend/src/microservices/agents-microservice/dto/agents-site-runtime-policy.dtos.ts

@@ -0,0 +1,20 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsNotEmpty, IsObject, IsString } from 'class-validator';
+
+export class SetSiteRuntimePolicyDto {
+	@ApiProperty({ description: 'The user on whose behalf the manifest is written — must hold connection:edit (Cedar).' })
+	@IsNotEmpty()
+	@IsString()
+	userId: string;
+
+	@ApiProperty({
+		type: 'object',
+		additionalProperties: true,
+		description:
+			'The site data contract (plan 13 §4): {auth, ownedRead, write}. Replaces the stored policy wholesale — ' +
+			'the generation agent always proposes the complete manifest it derived from the schema it created. ' +
+			'universal-backend parses it fail-closed, so unknown keys are inert and missing sections grant nothing.',
+	})
+	@IsObject()
+	policy: Record<string, unknown>;
+}